I have a polling HTTP pakcet that the LTM does not see as a proper compliant HTTP packet. Due to this the device sends a single packet in and the F5 closes the connection. This connection needs to remain open. To fix this, the HTTP profile is removed from the Virtual Server. The X-Forwarded header is needed fromn the packets that then flow through the LTM. The X-Forwarded header becomes the IP address of the LTM and not the source device. I am looking for an iRule that will look at this packet and extract the X-Forwarded contents and send it through, as the souce address sent becomes the interface of the LTM.

I amunable to write an iRule pickign out the following because I cannot use a HTTP profile. when HTTP_REQUEST { HTTP::header insert X-Forwarded-For [IP::client_addr] } SO I need to write an iRuke to look at the packet and take out X-Forwarded-For

Can you clarify this? Do you want LTM to spoof the value of the XFF header that a prior device in the chain inserted? Or do you want LTM to insert the IP address it received as the client into an XFF header? Aaron

Aaron Yes I need the iRule to put "X-Forwarded-for" of the original IP address otherwise, it puts the IP address of the LTM interface in the HTTP header. If I used a HTTP profile it inserted this inthe packet. I configured the profile to insert the X-Forwarded-For but due to the nature of the sending device the F5 does not then see this as a complaint HTTP packet. SO I am unable to apply a HTTP profile of any sort. Unable to write a simple iRule as it then requires an HTTP profile. SO if possible the packet that the back end server gets has the originator's IP and NOT the LTM interface. Thanks.

Aaron, I have been reading some other threads and wondered, if I make the IIS server (back end server) Def Gateway to be the LTM interface and turn off SNAT on thr VS will this resolve my issue? Will I be able to apply a HTTP profile and preserve the originating clients IP address ?Just a thought ....

If you need to see the original client IP address in logs and cannot add an HTTP profile, it would be a lot more efficient in terms of LTM processing to change the default gateway to the LTM and turn off SNAT on the VIP. You wouldn't need to insert the XFF header then or add an HTTP profile. Aaron

Use iRulke to extract X-Forwarded out of HTTP packet

14 Replies

Geoff_Littlewoo
Nimbostratus
Jul 27, 2009
Aaron,

I havnt changed to much. I have a basic HTTP profile with the iRule applied still SNAT and the back end server still configured NOT to use the LTM as Def Gateway.

If I dont use the iRule you posted above with the HTTP profile I only get a single pcket with the IP addres of the LTM. Using the iRule above my first packet contains the X-Forwarded-for but then reverts back to the LTM.
hooleylist
Cirrostratus
Jul 27, 2009
So it sounds like the client is making more than one HTTP request on the same TCP connection. If that happens, the HTTP profile and iRule would no longer be enabled, so the XFF header would not be inserted. That's the downside to disabling the HTTP profile.

If you want to insert the XFF header in every request on a TCP connection, you would need to collect the TCP payload and search every packet for some delimiter like HTTP/1.0\r\n or HTTP/1.1\r\n and replace it with HTTP/1.x\r\nX-Forwarded-For: [IP::client_addr]\r\n where x is the HTTP version. You could also potentially do this with a stream profile as the HTTP headers (not the payload) would be modified.

The easiest option though would be to change the servers' default gateway and remove the SNAT.

Aaron
Geoff_Littlewoo
Nimbostratus
Jul 27, 2009
Aaron,

Thats works a treat. I have other apps on that server(s) so need to check routnign/networking works and any issues....but initally looks OK...

I am hopign I will not hit a problem and the F5 will be able to deal with any routing/gateway issues .
hooleylist
Cirrostratus
Jul 27, 2009
You'll need to configure a virtual server or SNAT to allow the servers to originate traffic through LTM. The best option would be to configure a virtual server which points to a pool of one or more gateways with a FastL4 profile. You may need to enable SNAT on the outbound virtual server to ensure responses go back through LTM. You should also enable the outbound virtual server only on the servers' VLAN. This will ensure that only the servers will be able to use this VIP to route through LTM.

Aaron

Forum Discussion

Use iRulke to extract X-Forwarded out of HTTP packet

14 Replies

Recent Discussions

Migration from i series 10200 with 1 child VCMP to r series 10900 series

Azure DP-100 Exam Questions

Deploying F5 WAF in front of Azure Web App Services

What happens if I only enable ASM in BIG-IP Under System > Resource Provisioning

What is the meaning is 52% block in WAF

Related Content

Extracting X-Forwarded-For in Node.js

TCP Option 28 X-Forwarded-For Header

X-Forwarded-For on L4 VS

X-FORWARDED header in WAF

Restricting Access to Virtual from client IP address in X-Forwarder-For HTTP header